CueCruxVaultCrux

Private Team RAG Quickstart

This quickstart covers bootstrapping a tenant, inviting a team member, uploading private documents, and querying the team-scoped corpus.

Required environment variables

  • VAULTCRUX_API_URL
  • VAULTCRUX_API_KEY
  • VAULTCRUX_TENANT_ID

1) Validate your tenant is active

curl -fsS "$VAULTCRUX_API_URL/healthz"
curl -sS "$VAULTCRUX_API_URL/v1/credits/agent-1" \
  -H "x-tenant-id: $VAULTCRUX_TENANT_ID" \
  -H "x-api-key: $VAULTCRUX_API_KEY"

A successful credits response confirms your tenant and API key are active.

2) Invite a team member

curl -sS -X POST "$VAULTCRUX_API_URL/v1/seats/invite" \
  -H "content-type: application/json" \
  -H "x-tenant-id: $VAULTCRUX_TENANT_ID" \
  -H "x-api-key: $VAULTCRUX_API_KEY" \
  -d '{
    "email": "analyst@example.com",
    "role": "member"
  }'

Available roles: owner, admin, member, viewer. The invite token is single-use; delivery is handled manually in the current sprint.

3) Upload private documents

curl -sS -X POST "$VAULTCRUX_API_URL/v1/ingest" \
  -H "content-type: application/json" \
  -H "x-tenant-id: $VAULTCRUX_TENANT_ID" \
  -H "x-api-key: $VAULTCRUX_API_KEY" \
  -d '{
    "doc_id": "internal-policy-v3",
    "content": "...",
    "mime_type": "text/markdown",
    "metadata": {"classification": "internal", "team": "legal"}
  }'

Documents are stored in the private embeddings_768 store scoped to your tenant. Other tenants cannot access them.

4) Query scoped to the team corpus

curl -sS -X POST "$VAULTCRUX_API_URL/rpc" \
  -H "content-type: application/json" \
  -H "x-tenant-id: $VAULTCRUX_TENANT_ID" \
  -H "x-api-key: $VAULTCRUX_API_KEY" \
  -d '{
    "jsonrpc": "2.0",
    "id": "q-1",
    "method": "query_vault",
    "params": {
      "query": "What is the current data retention policy?",
      "agent_id": "agent-1"
    }
  }'

Results are strictly tenant-scoped. No cross-tenant bleed is possible in the private retrieval path.

5) Verify member access

Each invited member uses their own API key with the shared tenant_id. Keys should follow least-privilege practices — issue member-scoped keys that cannot modify tenant configuration.